IIUC github tokens are just a giant fiasco waiting to happen. Tokens are a password that "just works" and people are giving them out like candy to every company

IIUC github tokens are just a giant fiasco waiting to happen. Tokens are a password that "just works" and people are giving them out like candy to every company and service that integrates with github. If stolen (just like a password breach) the thieves can use those tokens to check in whatever random code they want into all your repos. This means they not only effect you (like when your bank password is stolen), they also affect everyone down stream of you. Tons of sites ask for effectively "Full permissions" and people give them full permission. They then get a token. If that token leaks the thief gets those full permissions